Pages

Friday, July 6, 2018

Categorizing and Enriching Security Events in an ELK with the Help of Sysmon and ATT&CK


Lately, I have been working on a few projects such as OSSEM, HELK and ThreatHunter-Playbook with a main goal of integrating all of them and starting to document and define how data can drive categorization and prioritization of detection analytics. 

I also had the opportunity to present with @_devonkerr_ from Endgame at BSidesCharm at the beginning of the year about "Quantifying Your Hunt".  We talked about how we could start measuring detection capabilities by mapping available data sources to MITRE ATT&CK Techniques. I enjoyed our conversation because we were able to prioritize specific data sources we could use to increase visibility across several ATT&CK techniques. One particular free tool that provided a lot of context across several techniques was Sysmon. I loved the fact that by linking security events to techniques, we could also start prioritizing the development of ATT&CK-based analytics.

One of the challenges that I faced with Sysmon was the fact that even though I was able to collect data and categorize events by the specific Sysmon Event IDs, it was hard to know what specific Sysmon rules were triggering every time an event was created. This was necessary to automatically map security events and potential incidents to ATT&CK techniques information. It could also help to understand the volume of specific data being collected per technique. 

Thanks to the recent update to Sysmon (Version 8.0), tagging Sysmon rules is now possible, and makes things much easier to add extra metadata to Sysmon events. 

In this post, I will show you a basic example of Sysmon rule tagging and how you can scale it with the right parser in solutions like HELK. I will share a few initial thoughts on how to utilize these new capabilities. NOTE: While I was testing a few things to write this blog post, @olafhartong published also his first attempt with the new version of Sysmon. I highly recommend checking out his post "Sysmon 8.0, a leap forward in event annotation". It has a similar basic example to start. Great work Olaf!!



Install Sysmon v8.0


The download and install process is very straight forward. One thing to remember is that with Sysmon version 8.0 the configuration schema version is now 4.1. I updated my basic Sysmon Config that I usually use to start logging events and creating a baseline of my lab environment. Feel free to download it and use it to start.



Figure 1: Part of initial Sysmon Configuration


Figure 2. Install Sysmon with specific configuration




So, What Is New?


In order to know right away about the new metadata added to the events, I decided to start a process and check the event schema. I launched Calculator.exe as shown in the image below. As you can see, there is a new data field named "RuleName". It is blank because I did not tag a Sysmon rule to include events generated or related to Calculator.exe.


Figure 3. Open Calculator and check the event log



Another great way to gather information about the Sysmon schema was posted by @olafhartong and can be found here. I like that approach because it will help me a lot to update all the Sysmon dictionaries I put together for Sysmon data in OSSEM right away. However, there is always extra metadata generated by the system that still needs to be parsed and is not in the Sysmon Schema. I copied the XML details of the event log generated for Calculator.exe so that you can see what to expect. I have already taken care of that for you with HELK.







Ok, How Do I Tag Sysmon Rules?


If you go to the Sysmon site and go to the "Event Filtering Entries" part, you will find the following details: 

"To have Sysmon report which rule match resulted in an event being logged, add names to rules: <NetworkConnect onmatch="exclude"> <Image name="network iexplore" condition="contains">iexplore.exe</Image> </NetworkConnect>"

So if I want to add a name to a rule that collects/include events generated by a process that ends with Calculator.exe, I can update my Sysmon config to the following:




Once I update the config, I have to also push an update to my Sysmon service


Figure 4. Update Sysmon Config with new rule name.



If I open the calculator app again, I should be able to see the RuleName field populated with the Calculator Rule tag in it:


Figure 5. Sysmon Calculator rule name.




MITRE ATT&CK Integration


One very good initial use case that I explained at the beginning of this post was  the automation of mapping security events and potential incidents from a Sysmon rule perspective to ATT&CK techniques information such as Tactic, Technique Name, Technique ID, Platform, etc. Following our initial basic calculator example, we can start tagging Sysmon rules that could relate to specific procedures defined in techniques used by adversaries.


Do I Just Pick Any Technique?


I usually recommend prioritizing what you can potentially see currently in your environment over just picking any technique in the matrix. For example, if you have Sysmon running in your environment and you are collecting "ProcessCreate" events, then you can prioritize techniques that require to have "Process Monitoring" or "Process command-line parameters" as data sources. Let's say we pick "Create Account - T1136"


Figure 6. Create Account Technique Information


ATT&CK Simulation Repos Help!


One thing that I love about the industry is that there are 'Red Team Simulation" projects that allow you to learn and test different variations of a specific technique.  My favorite projects out there that provide great information are Endgame's Red Team Automation (RTA) and RedCanary's Atomic Red Team (ART). I usually use the GitHub search bar on the repositories and look for a few initial commands or steps defined by ATT&CK in the techniques description information. For ART, you can also just go to the technique ID folder and learn more about it.


Figure 7. Endgame RTA


Figure 8. RedCanary ART


Add Sysmon Rule & Name


If your Sysmon config is already allowing you to capture events generated by the execution of net.exe due to the fact that you use your config to exclude instead of include events, you will have to change that in order to tag a specific Sysmon rule that could map directly to T1136. I updated mine to the following:




Why Don't You Add The Net.exe Condition to the Rule Name?


Great question! I recently parsed the whole ATT&CK database and made it part of a HELK Dashboard by default. If I look for net.exe by itself without any command arguments across the whole ATT&CK database, I find that there are around 13 techniques where net.exe is mentioned. That will be a lot of tags. This is why I recommend to be a little bit more specific if you want to start tagging and mapping Sysmon rule names to ATT&CK techniques .



Figure 9. net.exe across the whole ATT&CK database


Simulate The Technique


Run a few basic commands and check the results

net user /add wardog




Figure 9. Create Account simulation via net1.exe


Something interesting to mention after doing this exercise is that when the event that triggers a rule has other data fields without a rule name, it automatically excludes the RuleName tag value from the event. For example, the net.exe condition by itself does not have a rule name; However, CommandLine: user /add does. If net.exe is executed with user /add command-arguments, the event is shown with an empty RuleName. Only net1.exe shows with a rule name or tag. Keep that in mind when you start tagging rule names.



Figure 10. Create Account simulation via net.exe





Nice! Now, How Do I Parse the RuleName?


All those basic use cases make sense, but it is important to also cover how you could start using the flexibility of tagging Sysmon rules in your production environment. For the collection piece, you could use a WEF server and a Winlogbeat agent on the top to push data to a data lake or straight to your SIEM. I use KAFKA brokers to centralize the collection of several data sources and then an ELK stack to extract, transform, load, analyze and visualize the data.

One thing that I am sure you have noticed is that when we add several tags to one Sysmon rule, it separates the key=value by commas, so you will have to parse all that. If you are using an ELK Stack as your SIEM, you could use the Logstash KV filter plugin to parse the RuleName field values


Logstash KV Filter Config


According to Logstash documentation, the KV filter pluting helps automatically parse messages (or specific event fields) which are of the foo=bar variety.

  • source => The field to perform key=value searching on
  • field_split => A string of characters to use as single-character field delimiters for parsing out key-value pairs.
  • value_split => A non-empty string of characters to use as single-character value delimiters for parsing out key-value pairs.
  • prefix => A string to prepend to all of the extracted keys.
  • transform_key => Transform keys to lower case, upper case or capitals.
filter {
  if [log_name] == "Microsoft-Windows-Sysmon/Operational"{
    if [event_data][RuleName] {
      kv {
        source => "[event_data][RuleName]"
        field_split => ","
        value_split => "="
        prefix => "mitre_"
        transform_key => "lowercase"
      }
    }  
  }
}

Re-Simulate & Watch


Once, you have that filter in your Logstash pipeline, you will be able to transform/parse the RuleName field values of every endpoint that produces the data triggered by the Sysmon rule.

Figure 10. Event ID 1 - Sysmon Rule Tag



Figure 11. Event ID 1 - Sysmon Rule Tag metadata


That's it! I just wanted to share a little bit of my initial thoughts about utilizing the Sysmon rule tagging capabilities to start categorizing some of the data that you might be collecting via Sysmon. Even though this seems to be pretty straight forward, it is important to remember that some Sysmon rules might fall into the "Signature" vs "Situational Awareness" type of analytic. You can just add another tag named "analytic" and set it to Signature or Situational Awareness depending on your environment. Also, take in consideration that several techniques get repeated across several tactics when you tag Sysmon rules. I will be sharing more soon.


113 comments:

  1. I am using HELK so i created .conf file for the kv filter plugin and put it in the pipeline folder in the helk-logstash but still the rule name is not getting parsed. Can you please help me through it?

    ReplyDelete
    Replies
    1. health2delivery is an online shop.You can buy all medicines online from health2delivery.Adderall for ADHD,Xanax of anxiety disorders, Ambien for Insomnia , many more Pain killers, like Tramadol , hydrocodone etc ,You can buy from here.If you ever need generic medicines, please contact here once before going anywhere.

      Visit Us :- health2delivery.org
      CALL US :- + 1-850-424-1335
      CONTACT US :- sales@health2delivery.org

      We also sell medicines without a prescription. The best thing is that all the medicines here are administered by FDA. Save your precious time with money by buying medicine from here Because our company has made many records overnight delivery


      Delete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
  3. This comment has been removed by a blog administrator.

    ReplyDelete
  4. This comment has been removed by a blog administrator.

    ReplyDelete
  5. This comment has been removed by a blog administrator.

    ReplyDelete
  6. Excellent article. Very interesting to read. I really love to read such a nice article. Thanks! keep rocking.Big Data Hadoop Online Training

    ReplyDelete
  7. This comment has been removed by a blog administrator.

    ReplyDelete
  8. This comment has been removed by a blog administrator.

    ReplyDelete
  9. https://www.facebook.com/photo.php?fbid=138934543902776&set=pcb.138935430569354&type=3&theater

    I got her spinning! I will do it again tomorrow to the end. Too late tonight to keep my eyes open. But very excited about this. Thank you for the nice work.

    ReplyDelete
  10. Nice post, If you looking for a Data Protection Services than you can talk to our experts. Protect Your Data & Leverage it Beyond the Traditional Backup Copy.

    ReplyDelete
  11. how can i add users to helk for kibana

    ReplyDelete
  12. If more people that write articles involved themselves with writing great content like you, more readers would be interested in their writings. I have learned too many things from your article. Network Security Provider in Toronto

    ReplyDelete
  13. The platform field gets broken with kv as you see in the Kibana screenshot due to the carriage return in the eventlog (mitre_ platform)

    ReplyDelete
  14. https://www.serioussecurity.com.au/business-security/access-control/inner-range-integriti-access-control-system-experts/ Succeed! It could be one of the most useful blogs we have ever come across on the subject. Excellent info! I’m also an expert in this topic so I can understand your effort very well. Thanks for the huge help.

    ReplyDelete
  15. Wow! Such an amazing and helpful post this is. I really really love it. It's so good and so awesome. I am just amazed. I hope that you continue to do your work like this in the future also Security Installers

    ReplyDelete
  16. It is not that easy to secure your data nowadays. Proper protection against ransomware is essential.

    ReplyDelete
  17. I like your blog post. Keep on writing this type of great stuff. I'll make sure to follow up on your blog in the future.
    Cybex Technologies - Unified Communication and Security Solutions Provider

    ReplyDelete
  18. Hello do you know that the best treatment for opiod addiction,illegal or prescription is suboxone pills. Suboxone pills provides versatility in the way it helps patients.our medicated shop is the place to shop for all kinds of medication needs including;
    BuUY HYDROCODONE ONLINE
    BUY OXYCODONE ONLINE
    BUY OXYCONTIN ONLINE
    BUY VALIUM ONLINE
    BUY VYVANSE ONLINE
    BUY GABAPENTIN ONLINE
    BUY AMBIEN ONLINE
    Check out all our available pills on our online shop. https://greenlandspharmacy.com/

    ReplyDelete
  19. Excellent Blog! I would like to thank for the efforts you have made in writing this post. I am hoping the same best work from you in the future as well. I wanted to thank you for this websites! Thanks for sharing. Great websites! security firms leek

    ReplyDelete

  20. You can't believe what i just got,… A loan of $ 60,000. I have been looking for a loan for the past 2years until i was referred to a legitimate lender. Though it was not that easy to approve my loan, as you know nothing good comes easy. But I got my loan within 4 hours i got my loan, and before i knew it, the loan was transferred to me. please friends, don't let any body deceive you and scam you for this is real. Contact them via Email: gaincreditloan1@gmail.com OR You can also whatsApp them at: at +31-635-250-311 (WhatsApp Only)

    ReplyDelete
  21. Loan Opportunity Offered By Mr, Benjamin That Save My Family From Financial Bondage {lfdsloans@lemeridianfds.com}

    Hello Everyone, I am Putri Adiratnaa single mom from Jakarta, I would like to share this great testimony on how I got a loan from Mr, Benjamin, when we were driven out of our home when I couldn't pay my bills anymore, After being scammed by various companies online and denied a loan from my bank and some other credit union I visited. My children were taken by the foster care, I was all alone in the street. The day i shamefully walked into an old school mate who introduced me to Daisy Maureen. At first I told her that I am not ready to take any risk of requesting a loan online anymore, but she assured me that I will receive my loan from them. On a second thought, due to my homelessness I had to take a trial and applied for the loan, luckily for me I received a loan of $80,000.00 from Mr, Benjamin. I'm happy I took the risk and applied for the loan. My kids have been given back to me and now I own a home and a business of my own. All thanks and gratitude goes to Le_Meridian Funding Service and for the help of Mr, Benjamin for giving me a meaning to life when i had lost all hope. If you currently seeking for a loan assistance, you can contact them via: {lfdsloans@lemeridianfds.com} Or WhatsApp +1-989-394-3740

    ReplyDelete
  22. Hi There,
    Thank you for sharing the knowledgeable blog with us I hope that you will post many more blog with us:-
    Buy Oxycodone Online ,Buy Medication Online and Research Chemicals Online at Drustore07.com discreetly and fast delivery via UPS,DHL,FEDEX. 100% sure..
    Email:drugstores07@gmail.com
    Click here for more information:- more info/

    ReplyDelete
  23. Hi There,
    Thank you for sharing the knowledgeable blog with us I hope that you will post many more blog with us:-
    Buy Green Xanax Bar Online, is a powerful and highly addictive benzodiazepine drug which can be prescribed by doctors to treat anxiety, phobias, and panic.
    Email:info@medpillsphrama.com
    Click here for more information:- more info/

    ReplyDelete
  24. Hi There,
    Thank you for sharing the knowledgeable blog with us I hope that you will post many more blog with us:-
    Buy Methylone (bk-MDMA) Online,Methylone is a chemical drug which is very similar in structure to MDMA and has comparable effects.
    Email:info@bestonlinepainpharma.com
    Click here for more information:- more info/

    ReplyDelete
  25. You can buy Oxycodone online from our online pharnmacy
    With us you have delivery assurance and best quality .No need for a prescription
    Ordering privacy is 100%.
    Besides Oxycodone you can also order other Pain medicines.
    Order now at +18645132442 www.trustedmedsshop.com

    ReplyDelete
  26. Are you currently available for consulting work?

    ReplyDelete
  27. health2delivery is an online shop.You can buy all medicines online from health2delivery.Adderall for ADHD,Xanax of anxiety disorders, Ambien for Insomnia , many more Pain killers, like Tramadol , hydrocodone etc ,You can buy from here.If you ever need generic medicines, please contact here once before going anywhere.

    Visit Us :- health2delivery.org
    CALL US :- + 1-850-424-1335
    CONTACT US :- sales@health2delivery.org

    We also sell medicines without a prescription. The best thing is that all the medicines here are administered by FDA. Save your precious time with money by buying medicine from here Because our company has made many records overnight delivery


    ReplyDelete
  28. Sometime it becomes very hard to find a well written and well established bog which give you correct and useful information. However, I found this blog and got some relevant information which are really helpful for me.benzo chem shop

    ReplyDelete
  29. If you are looking to buy marijuana online or buy weed online, there are a few things to look out for. Most dispensaries nowadays sell not provide order marijuana online orders, they equally provide Hash Oil, Cannabis Oil, Weed TinsMarijuana Concentrates, Marijuana Seeds, Gummy Bears, Rick Simpson Oil and of course, Legal Marijuana for Sale Online, Marijuana Edibles, with a possibility to buy marijuana online with bitcoin

    ReplyDelete
  30. With THC vape pens and THC vape juice carried by THC vape Shops leading the way in the cannabis oil industry, a deeper look into the trend is warranted.

    ReplyDelete
  31. Recently, the canna industry has been going through an edit, with many previously ignored products like THC Cartridges now leading the way. Popular vape shops near me carry the following; CBD Oil, KingPen, Brass Knuckles, Cereal Carts, Dank Vapes, Mario Carts, Smart Carts, Stiiizy Pods. This is always a positive as innovation is always welcome in the industry, with no exceptions nonetheless. This growth represents the future of the canna industry, far and wide.

    ReplyDelete
  32. Thc vape cartridges or vape pens or thc carts as people call it is rare to find in vape stores near me this days.Is this because of the ban on juul pods?Juul pods near me are also becoming scare giving chills about cbd oil for pains or cbd oil for cancer since alot of vendors now buy cbd oil online.How ever the vape stores near me selling juul pods and vape pens alongside thc carts are taking over the mantle of selling juul pods near me.we can focus on vape juice,cheap vape juice,e juice and vape stores Great new articles on glock store bill in the senate about buy guns online or guns for sale such as the glock 19,stribog and many others

    ReplyDelete
  33. I have a similar interest this is my page read everything carefully and let me know what you think. Remote access iPhone hack service

    ReplyDelete
  34. Thanks For Posting Try New If Aol Mail is not showing images to mail recipients then to get that fixed, it is advisable to open the mail settings and from there the user will have to get HTML enabled, if needed then for further information the user should get connected with the certified Aol UK Helpline Toll Free Service experts. The lines are open for users all the time.

    ReplyDelete

  35. We are one of the top online marijuana dispensary for all your medical cannabis needs at affordable prices. At our Online Shop customer service always comes first. Please shop with us today top quality medical cannabis products. Ours is an Online Marijuana Dispensary also in Surrey British Columbia which provides top quality cannabis & vapes products in Canada, USA, Europe and other countries such as; Indica Strain, Sativa Strains, Hybri Strains, THC and CBD Oil, Hash, Wax, Volcano Vaporizer, Vapes Kits, Vape Tanks, Vape MODS, Vape Accessories & much more.

    ReplyDelete
  36. For more information, Contact us via:
    Email: counterfeitnotesonline@gmail.com
    Whatsapp number:+1 (480)269-2191
    Webside: www.counterfeitnotesonline.com
    Web Link: https://www.counterfeitnotesonline.com

    Page links:

    Buy Fake Euros online
    https://www.counterfeitnotesonline.com/2019/12/09/buy-fake-euros-online/

    ReplyDelete
  37. For more information, Contact us via:
    Email: counterfeitnotesonline@gmail.com
    Whatsapp number:+1 (480)269-2191
    Webside: www.counterfeitnotesonline.com
    Web Link: https://www.counterfeitnotesonline.com

    Page links:

    Buy Fake Euros online
    https://www.counterfeitnotesonline.com/2019/12/09/buy-fake-euros-online/

    ReplyDelete
  38. For more information, Contact us via:
    Email: counterfeitnotesonline@gmail.com
    Whatsapp number:+1 (480)269-2191
    Webside: www.counterfeitnotesonline.com
    Web Link: https://www.counterfeitnotesonline.com

    Page links:

    Buy Fake Euros online
    https://www.counterfeitnotesonline.com/2019/12/09/buy-fake-euros-online/

    ReplyDelete
  39. The grand stribog or call it Stribog is a top selling model just like the glock 19x,glock 19 and glocks in general.So looking for a glockstore or glock store to buy glocks online then you can check out the latest vast collection of pistols like the Grand power stribog sp9a1,Grand power stribog gen 2,Stribog gen 2,stribog 9mm,Grand power stribog brace,Springfield XDs,grand power stribog a3, Our glockstore has top selling vortex optics and magazines too like the vortex,viper,riflescopes,vortex viper.vortex binoculars,red dots vortex venom Feel free to browse through our great collection .

    ReplyDelete
  40. The grand stribog or call it Stribog is a top selling model just like the glock 19x,glock 19 and glocks in general.So looking for a glockstore or glock store to buy glocks online then you can check out the latest vast collection of pistols like the Grand power stribog sp9a1,Grand power stribog gen 2,Stribog gen 2,stribog 9mm,Grand power stribog brace,Springfield XDs,grand power stribog a3, Our glockstore has top selling vortex optics and magazines too like the vortex,viper,riflescopes,vortex viper.vortex binoculars,red dots vortex venom Feel free to browse through our great collection .

    ReplyDelete

  41. Psychedelics are a hallucinogenic class of drug whose primary action is to trigger psychedelic experiences via serotonin receptor agonism, causing specific psychological, visual and auditory changes, and altered state of consciousness. Major psychedelic drugs include mescaline, LSD, psilocybin, and DMT
    Buy psychedelic magic mushroom online at Shop . Buy and ship safe and fast here. Furthermore, We Offer wild and fresh mushrooms of all sorts. You just need to pick from the wide category. However, here at our Shop, we give you only the very best to ensure your satisfaction. Buy wild mushrooms Online from fine specialists largest range online from fresh, frozen & dried Mushrooms
    buy dmt online
    mdma
    dmt trip
    what is dmt
    mushrooms
    Ayahuasca
    lsd
    buy Penis envy
    Penis envy mushrooms
    Golden teacher mushrooms
    magic mushrooms
    buy liberty cap mushrooms
    lsd liquid
    buy liquid lsd
    dmt drug
    what is lsd
    buy albino penis envy
    what is penis envy
    ecstacy
    penis envy mushrooms
    molly
    kratom powder
    mescaline
    bath salt
    buy 2c-b online
    2c-b
    what is 2c-b
    https://trippyway.com/


    ReplyDelete
  42. Nice Blog. Get an amazing web designing services by OGEN Infosystem in Delhi, India.
    Best Website Designing Company in India

    ReplyDelete
  43. thanks for sharing this wonderful article. We are the best At&t support,at&t wirless support, Contact at&t helpline,at&t customer care How to Contact at&t wirless support

    ReplyDelete
  44. Best Article buy Pain Pills online Excellent post. I appreciate this site. Stick with it! Because the admin of this web page is working.
    Best Article buy Roxicodone online Excellent post
    buy Xanax online
    buy Oxycodone online
      buy Weed online

    Best Article buy Medical Marijuana online Excellent post.This website was how do you say it? Relevant!! Finally, I’ve found something that helped me.

    buy Weed online

    buy Meltblown Nonwoven Fabric online

      buy Roxicodone 30mg online 

    buy Research Chemicals online 
    buy CBD ISOLATE online     

    ReplyDelete
  45. thank for share great information such a beautiful article.

    air hostess institute

    ReplyDelete
  46. Hi , Just wanted to say thanks for this fantastic article.
    BT Mail Login - Enter your email address. Enter your password and login now. Now you can manager and access all the features of BT Mail.
    BT Login

    ReplyDelete
  47. puff bar cheap bulk usaWelcome to FatPuffWholesale store, Get the bulk puff bars for sale in the USA, We offer the best puff bar at the cheapest price. Shop now puffs bar bulk box online in the USA. Contact us now.

    ReplyDelete
  48. Hi There,
    Thank you for sharing the knowledgeable blog with us I hope that you will post many more blog with us:-
    skittles,dankvapes website,dankvapes, dankvapes cartridges,dankvapes lab test,dankvapes official, www dankvapes com,dankvapes flavors.
    EMAIL:info@vapecartridgesshop.com
    Click here for more information:- more info/

    ReplyDelete
  49. Legal Injectable Steroids

    Buy best Injectable Steroids Online Legally. We offer safe injection for muscle growth at affordable prices. Visit us to get injection for muscle growth.

    to get more - https://crazysteroid.org/product-category/injectables-steroids/

    ReplyDelete
  50. pre-rolled-backwoods
    dankwoods-pre-rolls
    There are so many valuable and high potential benefits of cannabis th upat a greater quater of the globe is still to discover yet,at medical cannabis bud shop we make sure every customer shopping from us gets the best in terms of quality of cannabis products purchased with 100% discreet shipment and deliveries.
    packwoods-pre-rolls
    pre rolled joints

    ReplyDelete
  51. Medical marijuana has already been successfully legalized in 23 US states.
    and California LA is one of the best state where top shelf medical marijuana are been sold at 420cannabisthrives.com
    Why? Because there is substantial scientific proof that weed is actually good for you.
    In fact, some researchers claim marijuana to be a natural panacea to a large number of diseases.
    Email us at service@420cannabisthrives.com for your order process and talk to our experts for advice...
    we provide reliable and discreet overnight delivery within 50 states and Canada and our branch in Netherlands is in charge of orders from Europe and Asia....
    we provide you with the best buds,cbd oils,thc cartridges,dankwoods,backwoods,cbd massage ceams,cbd capsules......
    CALL/TEXT:+13232078167
    EMAIL US AT: service@420cannabisthrives.com
    cbd-oil-for-sale
    gorilla-glue-4-seeds-for-sale-uk
    rove-carts-for-sale
    kingpen-carts-for-sale
    exotic-carts-for-sale
    where-can-i-buy-packwoods
    buy-stiiizy-pods-online
    barewwoods-for-sale
    buy-weed-online-canada
    buy-legal-weed-online
    weed-for-sale-online
    where-to-buy-weed-online
    where-to-buy-gorilla-glue
    kush-for-sale
    buy-moonrocks-online
    buy-weed-online
    og-kush-seeds-for-sale
    marijuana-for-sale-online
    backwoods-cigars-for-sale
    dankwoods-for-sale
    dabwoods-carts-for-sale

    ReplyDelete
  52. these cyber intruders are Dangerous and Manipulative they are out there causing financial, operation and reputational harm right now under your eyes without you even knowing! cyber security training in hyderabad

    ReplyDelete
  53. Thumbs up guys your doing a really good job. It is the intent to provide valuable information and best practices, including an understanding of the regulatory process.
    Cyber Security Course in Bangalore

    ReplyDelete
  54. Very nice blog and articles. I am realy very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post.
    Cyber Security Training in Bangalore

    ReplyDelete
  55. I will really appreciate the writer's choice for choosing this excellent article appropriate to my matter. Here is deep description about the article matter which helped me more.
    Best Institute for Cyber Security in Bangalore

    ReplyDelete
  56. Your website is very beautiful or Articles. I love it thank you for sharing for everyone. Buy Mail Order Magic Mushrooms Online

    ReplyDelete
  57. P&D World Birds Store is the largest live bird breeder and seller. We also sell bird food, bird toys, accessories and everything you need for your birds. Parakeets for Sale, Caiques for sale, Eclectus for sale, Cockatoos for sale, Conures for Sale, Amazons Parrots For sale, African Grey Parrots for Sale, Macaws for sale, LoveBirds for Sale, Senegal Parrots For Sale, Softbills For Sale, Toucans, and Touracos for Sale, Poicephalus for Sale, Pionus for Sale, Lories, and Lorikeets for Sale, Parrotlets for Sale. Exotic Birds For Sale



    Birds for sale
    African Grey Parrots for Sale
    Amazon Parrots for Sale
    Softbills For Sale
    Amazons Parrots For sale
    African Grey Parrots for Sale
    Cockatoos for sale
    Conures for Sale
    Macaws for sale
    LoveBirds for Sale
    Senegal Parrots For Sale
    Senegal Parrots For Sale
    Toucans and Touracos for Sale
    Pionus for Sale
    Lories and Lorikeets for Sale

    ReplyDelete
  58. Don´t fail to see the light. we are aware that there are lots of people online pretending to be one of our agent of Illuminati brotherhood. Be careful, not everyone you see online here is real. This organisation is for PEACE, WEALTH, POWER and FAME. The organisation requires no blood sacrifice If interested, kindly Whatsapp: +1(315)3161521

    ReplyDelete






  59. The Gamma Pharmacy is an online shop.You can buy all medicines online from The Gamma Pharmacy. Adderall for ADHD,Xanax of anxiety disorders, Ambien for Insomnia , many more Pain killers, like Tramadol , hydrocodone etc ,You can buy from here.If you ever need generic medicines, please contact here once before going anywhere.

    Visit Us :- The Gamma Pharmacy


    We also sell medicines without a prescription. The best thing is that all the medicines here are administered by FDA. Save your precious time with money by buying medicine from here Because our company has made many records overnight delivery


    If You Want To Buy Generic Meds Online Visit To Our Site and Find The Best generic Meds in United states.Buy Xanax Online
    Buy Fioricet Online
    Buy Ambien Online
    Buy Valium/Diazepam Online
    Buy Adderall Online
    Buy Levitra Online
    Buy Viagra Online
    Buy Adderall Online
    Buy Ambien Online
    Buy Cialis Online
    Buy Fioricet Online
    Buy Levitra Online
    Buy Tramadol Online
    Buy Valium/Diazepam Online
    Buy Viagra Online

    ReplyDelete

  60. Good meds Online is an online shop.You can buy all medicines online from Good meds Online. Adderall for ADHD,Xanax of anxiety disorders, Ambien for Insomnia , many more Pain killers, like Tramadol , hydrocodone etc ,You can buy from here.If you ever need generic medicines, please contact here once before going anywhere.

    Visit Us :- good meds online


    We also sell medicines without a prescription. The best thing is that all the medicines here are administered by FDA. Save your precious time with money by buying medicine from here Because our company has made many records overnight delivery

    ReplyDelete
  61. Very informative post! This post gives truly quality information. I find that this post is really amazing. Thank you for this brief explanation and very nice information.

    office.com/setup
    mcafee.com/activate

    ReplyDelete